@nockdev/awf 6.2.0

package/.agent/workflows/scaffold.md

@@ -0,0 +1,119 @@
+---
+description: "🏗️ Unified scaffolding & code generation: components, pages, services, models, APIs from project patterns"
+skills: { required: [], contextual: [auto] }
+---
+
+# 🏗️ /scaffold — Scaffold Pro
+
+> Unified Framework-Aware Code Generation
+> 📚 Auto-Detect • Convention Matching • 30+ Templates • Multi-Stack
+> ℹ️ Also accessible via `/generate` (alias)
+
+---
+
+## SCAFFOLD FLOW
+
+1. **DETECT** (Auto) — Identify framework via HSA (`hsa_detect_stack`), load patterns via HSA (`hsa_get_context`), scan existing components. Show: `[Step 1/6] Detecting React + TypeScript...`
+2. **MATCH** — Analyze existing code patterns: naming (camelCase/snake_case/PascalCase), file organization (flat/nested), imports (absolute/relative/barrel), exports, test location. Show: `[Step 2/6] Found: camelCase, barrel exports, co-located tests`
+3. **PREVIEW** — Show all files to be created with content preview → ⛔ STOP: confirm before generate
+4. **GENERATE** — Create files from template, wire up imports/routes, add boilerplate tests. Show: `[Step 4/6] Creating UserCard (3 files)...`
+5. **VERIFY** — Build check, list created files, suggest next steps
+6. **SYNC** — `hsa_check_changes` to update index after file creation
+
+---
+
+## COMMANDS
+
+| Command                       | Description            | Output                     |
+| ----------------------------- | ---------------------- | -------------------------- |
+| `/scaffold component [name]`  | UI component           | Component + styles + test  |
+| `/scaffold page [name]`       | Page/route             | Page + layout              |
+| `/scaffold service [name]`    | Service/repository     | Service + interface + test |
+| `/scaffold model [name]`      | Data model/entity      | Model + migration          |
+| `/scaffold api [route]`       | REST API endpoint      | Handler + service + test   |
+| `/scaffold module [name]`     | Full module (CRUD)     | All files                  |
+| `/scaffold hook [name]`       | Custom hook/composable | Hook + test                |
+| `/scaffold test [file]`       | Test file for existing | Test file with coverage    |
+| `/scaffold layout [name]`     | Layout component       | Layout + styles            |
+| `/scaffold middleware [name]` | Middleware/interceptor | Middleware + test          |
+| `/scaffold dto [name]`        | Data transfer object   | DTO + validation           |
+
+> Alias: all commands also accessible via `/generate` (e.g., `/generate model User`)
+
+---
+
+## 📋 CONVENTION MATCHING
+
+> Before generating, analyze existing code to match project conventions:
+
+```yaml
+pattern_scan:
+  naming: "camelCase | snake_case | PascalCase | kebab-case"
+  file_org: "flat | nested (component/__tests__/Component.test.ts)"
+  imports: "absolute (@/...) | relative (./...) | barrel (index.ts)"
+  exports: "default | named | barrel"
+  tests: "co-located (__tests__/) | separate (tests/) | same-dir (.test.ts)"
+  formatting: "prettier | eslint | language-default"
+```
+
+---
+
+## 🔧 FRAMEWORK TEMPLATES
+
+### Frontend
+
+| Framework | component                                         | page                               | hook/composable                | service                          |
+| --------- | ------------------------------------------------- | ---------------------------------- | ------------------------------ | -------------------------------- |
+| React     | `src/components/{Name}/{Name}.tsx + test + index` | `src/pages/{Name}Page.tsx`         | `src/hooks/use{Name}.ts`       | `src/services/{name}.service.ts` |
+| Next.js   | `components/{Name}/{Name}.tsx + module.css`       | `app/{name}/page.tsx + layout.tsx` | —                              | `lib/{name}.ts`                  |
+| Nuxt      | `components/{Name}.vue`                           | `pages/{name}.vue`                 | `composables/use{Name}.ts`     | `server/api/{name}.ts`           |
+| Vue       | `src/components/{Name}.vue`                       | `src/views/{Name}View.vue`         | `src/composables/use{Name}.ts` | `src/services/{name}.service.ts` |
+| Angular   | `ng generate component {name}`                    | —                                  | —                              | `ng generate service {name}`     |
+| Svelte    | `src/lib/components/{Name}.svelte`                | `src/routes/{name}/+page.svelte`   | —                              | `src/lib/services/{name}.ts`     |
+
+### Backend
+
+| Stack   | handler/controller                     | service                               | repository                             | model                        | test                   |
+| ------- | -------------------------------------- | ------------------------------------- | -------------------------------------- | ---------------------------- | ---------------------- |
+| Go      | `internal/handlers/{name}_handler.go`  | `internal/services/{name}_service.go` | `internal/repositories/{name}_repo.go` | `internal/models/{name}.go`  | `{file}_test.go`       |
+| Express | `src/controllers/{name}.controller.ts` | `src/services/{name}.service.ts`      | —                                      | `src/models/{name}.model.ts` | —                      |
+| Python  | `src/api/{name}_router.py`             | `src/services/{name}_service.py`      | —                                      | `src/models/{name}.py`       | `tests/test_{name}.py` |
+
+### Mobile
+
+| Stack        | screen                           | widget/component                 | state                               | model                    |
+| ------------ | -------------------------------- | -------------------------------- | ----------------------------------- | ------------------------ |
+| Flutter      | `lib/screens/{name}_screen.dart` | `lib/widgets/{name}_widget.dart` | `lib/blocs/{name}/{name}_bloc.dart` | `lib/models/{name}.dart` |
+| React Native | `src/screens/{Name}Screen.tsx`   | `src/components/{Name}.tsx`      | `src/hooks/use{Name}.ts`            | —                        |
+
+---
+
+## 📦 Generator Tools by Stack
+
+| Stack            | Generator Tools               | Model Pattern                | API Pattern                    |
+| ---------------- | ----------------------------- | ---------------------------- | ------------------------------ |
+| **Go**           | `go generate, sqlc, ent`      | Domain struct + JSON/DB tags | Handler → Service → Repository |
+| **Rust**         | `cargo-generate, sea-orm-cli` | Struct + derive macros       | Axum handler → impl            |
+| **Java**         | `Spring Initializr, JHipster` | @Entity + JPA annotations    | @RestController → @Service     |
+| **Kotlin**       | `Spring Initializr, Ktor Gen` | data class + @Entity         | Ktor routes → Service          |
+| **C#**           | `dotnet new, EF Core`         | Class + EF annotations       | Controller → Service           |
+| **Python**       | `cookiecutter, FastAPI gen`   | SQLAlchemy/Pydantic          | @router → CRUD                 |
+| **Ruby**         | `rails generate`              | ActiveRecord model           | Rails controller               |
+| **PHP**          | `artisan make, symfony make`  | Eloquent/Doctrine            | Controller + Resource          |
+| **TypeScript**   | `nest generate, hygen`        | Interface + Prisma           | Controller → Service           |
+| **Next.js**      | `npx create-next-app`         | Prisma model                 | API route handler              |
+| **Vue/Nuxt**     | `nuxi add`                    | Composable                   | Pages + API routes             |
+| **Angular**      | `ng generate`                 | Interface + Service          | Component + Module             |
+| **Flutter**      | `mason make`                  | Freezed model                | BLoC pattern                   |
+| **React Native** | `npx create-expo-app`         | TypeScript model             | Hook + API layer               |
+
+---
+
+## ⛔ SAFETY
+
+- Never overwrite existing files
+- Show file list before creation
+- Confirm if > 5 files will be created
+- Validate names against project conventions
+- Detect and warn about naming conflicts
+- Preserve import ordering conventions

package/.agent/workflows/security.md

@@ -0,0 +1,186 @@
+---
+description: "🔒 Security scanning & remediation: SAST, SCA, secrets, containers, licenses"
+skills: { required: [security], contextual: [auto] }
+---
+
+# 🔒 /security — Security Pro
+
+> Active Security Scanning & Automated Remediation
+> 📚 SAST • SCA • Secrets • Containers • Licenses • Auto-Fix
+> ℹ️ For checklist-based audit, use `/ap security`. This workflow runs actual tools.
+
+---
+
+## SECURITY FLOW
+
+1. **DETECT** — Identify stack via HSA (`hsa_detect_stack`), discover available security tools, load security context (`hsa_get_context`). Show: `[Step 1/6] Detecting: Node.js + Go monorepo`
+2. **SCAN** — Execute selected scan type(s), collect findings in structured format. Show: `[Step 2/6] Running SAST scan... 47 files analyzed`
+3. **ANALYZE** — Deduplicate, correlate findings, assign severity (Critical/High/Medium/Low), filter false positives. Show: `[Step 3/6] Found: 2 critical, 5 high, 12 medium`
+4. **REPORT** — Structured report with evidence, CWE/CVE references, fix suggestions. Show severity summary
+5. **FIX** (Optional) — Auto-fix safe issues, suggest fixes for complex ones → ⛔ STOP: confirm before applying
+6. **SYNC** — `hsa_check_changes` to update index after fixes
+
+---
+
+## COMMANDS
+
+| Command                    | Description               | Scope                       |
+| -------------------------- | ------------------------- | --------------------------- |
+| `/security`                | Full scan (all types)     | Entire project              |
+| `/security scan`           | Full scan (explicit)      | Entire project              |
+| `/security sast`           | Static analysis           | Source code vulnerabilities |
+| `/security deps`           | Dependency audit (SCA)    | Known CVEs in dependencies  |
+| `/security secrets`        | Secret scanning           | Leaked credentials/keys     |
+| `/security container`      | Container image scan      | Dockerfile/image vulns      |
+| `/security license`        | License compliance        | OSS license risks           |
+| `/security fix [id]`       | Auto-fix specific finding | Single vulnerability        |
+| `/security --scope [path]` | Limit scan scope          | Specific directory/file     |
+| `/security --ci`           | CI-friendly output        | JSON/SARIF for CI pipelines |
+
+---
+
+## 🛠️ TOOL REGISTRY
+
+### SAST (Static Application Security Testing)
+
+```yaml
+sast_tools:
+  javascript:
+    primary: "npx semgrep --config auto --json"
+    fallback: "npx eslint --plugin security --format json"
+  python:
+    primary: "bandit -r src/ -f json"
+    fallback: "ruff check --select S --output-format json"
+  go:
+    primary: "gosec -fmt json ./..."
+    fallback: "go vet ./..."
+  java:
+    primary: "semgrep --config auto --json"
+  ruby:
+    primary: "brakeman --format json"
+  php:
+    primary: "phpstan analyse --error-format json"
+  general:
+    primary: "semgrep --config auto --json"
+```
+
+### SCA (Software Composition Analysis)
+
+```yaml
+sca_tools:
+  npm: "npm audit --json"
+  yarn: "yarn audit --json"
+  pnpm: "pnpm audit --json"
+  pip: "pip-audit --format json"
+  go: "govulncheck -json ./..."
+  cargo: "cargo audit --json"
+  maven: "mvn dependency-check:check"
+  nuget: "dotnet list package --vulnerable --format json"
+  composer: "composer audit --format json"
+  bundler: "bundle audit check --format json"
+```
+
+### Secrets Scanning
+
+```yaml
+secret_patterns:
+  high_confidence:
+    - "AWS[_-]?(ACCESS|SECRET)[_-]?KEY"
+    - "AKIA[0-9A-Z]{16}" # AWS Access Key
+    - "ghp_[a-zA-Z0-9]{36}" # GitHub PAT
+    - "sk-[a-zA-Z0-9]{48}" # OpenAI API Key
+    - "xoxb-[0-9]{10,13}" # Slack Bot Token
+    - "PRIVATE KEY-----" # Private keys
+  checks:
+    - ".env files not in .gitignore"
+    - "Hardcoded passwords in config"
+    - "API keys in source code"
+    - "Tokens in commit history"
+  tools:
+    primary: "trufflehog filesystem --json ."
+    fallback: "grep -rn patterns"
+```
+
+### Container Scanning
+
+```yaml
+container_tools:
+  primary: "trivy image --format json"
+  alternatives:
+    - "docker scout cves --format json"
+    - "grype image --output json"
+  filesystem: "trivy fs --format json ."
+```
+
+### License Compliance
+
+```yaml
+license_tools:
+  npm: "npx license-checker --json"
+  pip: "pip-licenses --format json"
+  go: "go-licenses csv ."
+  cargo: "cargo license --json"
+
+risk_levels:
+  copyleft: ["GPL-2.0", "GPL-3.0", "AGPL-3.0"] # 🔴 High risk
+  weak_copyleft: ["LGPL-2.1", "MPL-2.0"] # 🟡 Medium risk
+  permissive: ["MIT", "Apache-2.0", "BSD-2", "ISC"] # 🟢 Low risk
+```
+
+---
+
+## 📊 FINDING FORMAT
+
+```
+🔒 [CRITICAL] CWE-89: SQL Injection
+📁 src/api/users.go:42
+📝 Unsanitized user input in SQL query
+🔍 Evidence: `db.Query("SELECT * FROM users WHERE id=" + userID)`
+💡 Fix: Use parameterized query `db.Query("SELECT * FROM users WHERE id=$1", userID)`
+📚 Ref: https://cwe.mitre.org/data/definitions/89.html
+```
+
+---
+
+## 📋 REPORT FORMAT
+
+```
+🔒 SECURITY SCAN — [project] — [date]
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+Scan Types: SAST ✅ | SCA ✅ | Secrets ✅ | Container ⏭️ | License ✅
+
+| Severity | Count | Auto-fixable |
+| Critical |     2 |            1 |
+| High     |     5 |            3 |
+| Medium   |    12 |            8 |
+| Low      |     7 |            7 |
+
+⏱️ Duration: 45s | Files: 128 | Dependencies: 47
+📁 Full: .domyh/security_YYYY-MM-DD.json
+```
+
+---
+
+## 🔄 vs `/ap security`
+
+| Feature  | `/security`            | `/ap security`   |
+| -------- | ---------------------- | ---------------- |
+| Type     | **Active scanning**    | Checklist review |
+| Tools    | SAST/SCA/Secrets/Trivy | AI analysis only |
+| Speed    | ~2-5 min               | ~30 min          |
+| Output   | Scan results + SARIF   | Audit findings   |
+| Auto-fix | ✅ Yes                 | ❌ No            |
+| When     | During development     | Pre-release gate |
+| CI/CD    | ✅ `--ci` flag         | ❌ Interactive   |
+
+> 💡 **Best practice**: Run `/security` during development, `/ap security` before release.
+
+---
+
+## ⛔ SAFETY
+
+- Never auto-fix without user confirmation
+- Never expose actual secret values in reports (mask to `sk-****...****`)
+- Warn before scanning large directories (> 10,000 files)
+- Skip scanning `node_modules/`, `vendor/`, `.git/` by default
+- Output findings to `.domyh/` (gitignored) for sensitive content

package/.agent/workflows/status.md

@@ -0,0 +1,103 @@
+---
+description: "📊 Project health: build, tests, coverage, lint metrics, and recent activity"
+skills: { required: [], contextual: [auto] }
+---
+
+# 📊 /status — Status Pro
+
+> Project Health Dashboard
+> 📚 Multi-stack • Auto-detect • Actionable • Trend Tracking
+
+---
+
+## STATUS FLOW
+
+1. **DETECT** — Identify project stack via HSA (`hsa_detect_stack`), config files. Show: `[Step 1/3] Detected: Go + TypeScript monorepo`
+2. **COLLECT** — Run build, tests, coverage, lint, dep check, `hsa_status` (engine health). Show: `[Step 2/3] Running 6 checks...`
+3. **REPORT** — Calculate health score, identify issues, compare with previous
+
+---
+
+## COMMANDS
+
+| Command         | Description         |
+| --------------- | ------------------- |
+| `/status`       | Full health report  |
+| `/status quick` | Brief summary       |
+| `/status build` | Build status only   |
+| `/status tests` | Test status only    |
+| `/status deps`  | Dependencies status |
+| `/status trend` | Compare history     |
+
+---
+
+## 🔧 COMMANDS BY STACK
+
+| Language   | Build                  | Test               | Coverage                | Lint                   | Deps                                      |
+| ---------- | ---------------------- | ------------------ | ----------------------- | ---------------------- | ----------------------------------------- |
+| Go         | `go build ./...`       | `go test -v ./...` | `go test -cover`        | `golangci-lint run`    | `go list -m -u all`                       |
+| TypeScript | `npm run build`        | `npm test`         | `npm run test:coverage` | `npm run lint`         | `npm outdated`                            |
+| Python     | `python -m py_compile` | `pytest -v`        | `pytest --cov`          | `ruff check .`         | `pip list --outdated`                     |
+| Rust       | `cargo build`          | `cargo test`       | `cargo tarpaulin`       | `cargo clippy`         | `cargo outdated`                          |
+| Java       | `mvn compile`          | `mvn test`         | `mvn jacoco:report`     | `mvn checkstyle:check` | `mvn versions:display-dependency-updates` |
+| C#         | `dotnet build`         | `dotnet test`      | `coverlet`              | `dotnet format`        | `dotnet list package --outdated`          |
+
+---
+
+## 📋 HEALTH THRESHOLDS
+
+| Metric   | 🟢 Good    | 🟡 Warning    | 🔴 Critical   |
+| -------- | ---------- | ------------- | ------------- |
+| Build    | Pass       | Warnings      | Fail          |
+| Tests    | 100% pass  | > 95%         | < 95%         |
+| Coverage | > 80%      | 60-80%        | < 60%         |
+| Lint     | 0 issues   | < 10 warnings | Errors        |
+| Security | 0 vulns    | Low/medium    | High/critical |
+| Deps     | Up to date | Patch/minor   | Major behind  |
+
+---
+
+## 📊 HEALTH SCORE
+
+| Component | Weight |
+| --------- | ------ |
+| Build     | 20%    |
+| Tests     | 20%    |
+| Coverage  | 15%    |
+| Lint      | 10%    |
+| Security  | 15%    |
+| CI/CD     | 10%    |
+| Git       | 10%    |
+
+### Report Format
+
+```
+📊 Project Health: 87/100 (🟢 Good)
+
+Build    🟢 Pass        Tests    🟢 42/42 (100%)
+Coverage 🟡 72%          Lint     🟢 0 issues
+Security 🟢 0 vulns      Deps     🟡 3 outdated
+CI/CD    🟢 Last pass    Git      🟢 Clean
+
+⚡ Quick wins: Coverage +8% → run `/test write utils`
+```
+
+---
+
+## 🚀 CI/CD STATUS
+
+| Command                 | Description         |
+| ----------------------- | ------------------- |
+| `gh run list --limit 5` | GitHub Actions runs |
+| `gh run view {id}`      | Run details         |
+
+---
+
+## 🔀 GIT STATUS
+
+| Command                                  | Info                |
+| ---------------------------------------- | ------------------- |
+| `git branch --show-current`              | Current branch      |
+| `git status --porcelain`                 | Uncommitted changes |
+| `git rev-list --count HEAD ^origin/main` | Ahead of remote     |
+| `git stash list`                         | Stashed changes     |

package/.agent/workflows/test.md

@@ -0,0 +1,157 @@
+---
+description: "✅ Run existing tests and write new test cases with proper coverage"
+skills: { required: [testing], contextual: [auto] }
+---
+
+# ✅ /test — Test Pro
+
+> TDD-First Testing with Coverage Tracking
+> 📚 Multi-language • Auto Test Loop • TDD Iron Law • Property-Based Testing
+
+---
+
+## TEST FLOW
+
+1. **DETECT** — Identify stack via HSA (`hsa_detect_stack`), load test context (`hsa_get_context`), find test framework, existing tests. Show: `[Step 1/6] Detecting test setup...`
+2. **RUN** — Execute tests, collect coverage. Show: `[Step 2/6] Running 42 tests... ✅ 40 passed, ❌ 2 failed`
+3. **ANALYZE** — Identify failures, coverage gaps, suggest missing test categories
+4. **WRITE** — Generate missing tests (TDD cycle). Show progress: `[Step 4/6] Writing tests for UserService (3/5 cases)`
+5. **VERIFY** — Re-run, confirm coverage improved. Show: `Coverage: 68% → 82% (+14%)`
+6. **SYNC** — `hsa_check_changes` to update index after test file creation
+
+---
+
+## COMMANDS
+
+| Command                  | Description                   |
+| ------------------------ | ----------------------------- |
+| `/test`                  | Run all tests                 |
+| `/test [file]`           | Test specific file            |
+| `/test write [feature]`  | Write tests for feature (TDD) |
+| `/test coverage`         | Coverage report               |
+| `/test generate [class]` | Auto-generate test cases      |
+| `/test watch`            | Watch mode                    |
+| `/test mutate [file]`    | Mutation testing              |
+| `/test property [func]`  | Property-based testing        |
+| `/test uat [scenario]`   | UAT test execution            |
+| `/test contract [api]`   | Consumer-driven contract test |
+
+---
+
+## 🔴🟢🔵 TDD — THE IRON LAW
+
+> **NO PRODUCTION CODE WITHOUT FAILING TEST FIRST**
+
+```
+🔴 RED → Write failing test
+    ↓
+🟢 GREEN → Minimum code to pass
+    ↓
+🔵 REFACTOR → Clean up (stay green)
+    ↓
+↻ Repeat
+```
+
+### Common Rationalizations (IGNORE THESE)
+
+| Excuse               | Reality                        |
+| -------------------- | ------------------------------ |
+| "Too slow"           | Saves debugging time 10x       |
+| "Too simple to test" | Simple code breaks too         |
+| "Will add later"     | Technical debt never gets paid |
+| "Only a prototype"   | Prototypes become production   |
+
+---
+
+## TESTING FRAMEWORKS
+
+| Language   | Framework        | Runner                | Coverage          | Mocking            |
+| ---------- | ---------------- | --------------------- | ----------------- | ------------------ |
+| Go         | testing (stdlib) | `go test ./...`       | `go test -cover`  | testify, gomock    |
+| TypeScript | Jest / Vitest    | `npx jest` / `vitest` | `--coverage`      | jest.mock, vi.mock |
+| Python     | pytest           | `pytest -v`           | `pytest --cov`    | unittest.mock      |
+| Rust       | built-in         | `cargo test`          | `cargo tarpaulin` | mockall            |
+| Java       | JUnit 5          | `mvn test`            | JaCoCo            | Mockito            |
+| C#         | xUnit / NUnit    | `dotnet test`         | Coverlet          | Moq, NSubstitute   |
+| Ruby       | RSpec / Minitest | `rspec`               | SimpleCov         | rspec-mocks        |
+| PHP        | PHPUnit / Pest   | `phpunit`             | `--coverage-html` | Mockery            |
+
+---
+
+## TEST STRUCTURE: AAA Pattern
+
+> **A**rrange → **A**ct → **A**ssert
+
+### Naming Convention
+
+| Pattern                                | Example                                         |
+| -------------------------------------- | ----------------------------------------------- |
+| `test_[action]_[condition]_[expected]` | `test_create_user_with_valid_data_returns_user` |
+| `should_[expected]_when_[condition]`   | `should_return_error_when_email_invalid`        |
+
+---
+
+## COVERAGE TARGETS
+
+| Type           | Target         | Focus                 |
+| -------------- | -------------- | --------------------- |
+| Unit           | > 80%          | Business logic, utils |
+| Integration    | > 60%          | API endpoints, DB ops |
+| E2E            | Critical flows | User journeys         |
+| Critical paths | 100%           | Auth, payments, data  |
+
+---
+
+## 🧬 PROPERTY-BASED TESTING
+
+> Instead of testing specific examples, test **properties** that should always hold true
+
+```yaml
+tools:
+  go: "gopter, rapid"
+  python: "hypothesis"
+  typescript: "fast-check"
+  rust: "proptest"
+  java: "jqwik"
+
+example: |
+  # Property: reverse(reverse(list)) == list
+  # Property: sort(list).length == list.length
+  # Property: parse(serialize(obj)) == obj
+```
+
+---
+
+## 🦠 MUTATION TESTING
+
+> Verify test quality by introducing mutations (small code changes) and checking if tests catch them
+
+```yaml
+tools:
+  javascript: "stryker"
+  python: "mutmut, cosmic-ray"
+  java: "pitest"
+  go: "go-mutesting"
+  rust: "cargo-mutants"
+
+score_target: "> 70% mutation score (killed / total mutations)"
+```
+
+---
+
+## AI TEST GENERATION
+
+| Input                        | Output                                                                  |
+| ---------------------------- | ----------------------------------------------------------------------- |
+| `/test generate UserService` | test_create_success, test_invalid_email, test_duplicate, test_not_found |
+| Function signature           | Happy path + edge cases + error cases                                   |
+
+### LLM-as-Judge
+
+| Dimension   | Weight | Criteria              |
+| ----------- | ------ | --------------------- |
+| Correctness | 30%    | Tests valid behavior? |
+| Coverage    | 25%    | Edge cases covered?   |
+| Readability | 20%    | Clear naming, AAA?    |
+| Isolation   | 15%    | No shared state?      |
+| Performance | 10%    | Fast execution?       |